Functions/Public/Remove-MsGApplicationFederatedCredential.ps1
|
function Remove-MsGApplicationFederatedCredential { <# .SYNOPSIS Removes a specified federated credential from an app registration in Entra ID. .DESCRIPTION This function removes a specified federated identity credential from an app registration in Entra ID. .PARAMETER DisplayName Display Name of the app registration. .PARAMETER AppId App/Client Id of the app registration. .PARAMETER ObjectId Object Id of the app registration. .PARAMETER FCId ID of the federated credential. .PARAMETER Force Bypasses the confirmation check. .PARAMETER Headers Authentication Headers to connect to Microsoft Graph. .PARAMETER Jwt Jwt to connect to Microsoft Graph. .EXAMPLE PS> Remove-MsGApplicationFederatedCredential -DisplayName TestApp-01 -FCId 4398daf5-3f3d-4ed7-b705-b954df66682b -Force Removes the federated identity credential that is tied to id "4398daf5-3f3d-4ed7-b705-b954df66682b". #> [CmdletBinding(SupportsShouldProcess, DefaultParameterSetName = 'Name')] param( [parameter(Mandatory = $true, ParameterSetName = 'Name', Position = 0, ValueFromPipeline = $true, ValueFromPipelineByPropertyName = $true)][string]$DisplayName, [parameter(Mandatory = $true, ParameterSetName = 'AppId', Position = 1)][string]$AppId, [parameter(Mandatory = $true, ParameterSetName = 'ObjId', Position = 2)][string]$ObjectId, [parameter(Mandatory = $true, Position = 3)][string]$FCId, [parameter(Mandatory = $false)][switch]$Force, [parameter(Mandatory = $false)][hashtable]$Headers, [parameter(Mandatory = $false)][string]$Jwt ) BEGIN { # Session Checks if ([string]::IsNullOrEmpty($Headers) -and [string]::IsNullOrEmpty($Jwt)) { if ($null -ne $myGraphToken) { Write-Verbose "Setting Jwt to Global: $myGraphToken" $Jwt = $myGraphToken } } if ([string]::IsNullOrEmpty($Headers) -and -not([string]::IsNullOrEmpty($Jwt))) { $Headers = @{ 'Authorization' = 'Bearer {0}' -f $Jwt 'Content-Type' = 'application/json' } } if ([string]::IsNullOrEmpty($Headers)) { $errorMessage = '{0} : Unable to run command. Headers are empty.' -f $MyInvocation.MyCommand.Name throw $errorMessage } # end Session Checks } PROCESS { # Retrieve Application from Entra ID try { switch ($PSCmdlet.ParameterSetName) { "Name" { $appEndpoint = "applications?`$filter=displayName eq '{0}'" -f $DisplayName } "AppId" { $appEndpoint = "applications?`$filter=appId eq '{0}'" -f $AppId } "ObjId" { $appEndpoint = "applications/{0}" -f $ObjectId } } $application = Invoke-MsGRequest -Method Get -Endpoint $appEndpoint -Headers $Headers -ErrorAction 'Stop' if ([string]::IsNullOrEmpty($application)) { $errorMessage = 'Application not found.' throw $errorMessage } } catch { $errorMessage = Get-MsGErrorMessage $_ $errorException = '{0} : Unable to retrieve application from Entra ID. Error: {1}' -f $MyInvocation.MyCommand.Name, $errorMessage throw $errorException } # end region # Validate Federated Credential Exists try { $appFedCredEndpoint = "applications/{0}/federatedIdentityCredentials/{1}" -f $application.id, $FCId $federatedCredential = Invoke-MsGRequest -Method Get -Endpoint $appFedCredEndpoint -Headers $Headers -ErrorAction 'Stop' if ([string]::IsNullOrEmpty($federatedCredential)) { $errorMessage = 'Federated Credential not found.' throw $errorMessage } } catch { $errorMessage = Get-MsGErrorMessage $_ $errorException = '{0} : Unable to retrieve federated credential from Entra ID. Error: {1}' -f $MyInvocation.MyCommand.Name, $errorMessage throw $errorException } # end region # Remove federated credential if (($PSCmdlet.ShouldProcess($application.displayName, 'Remove Application Federated Credential')) -and ($Force.IsPresent -or ($PSCmdlet.ShouldContinue("Remove '$FCId' from '$($application.displayName)'.", 'Are you sure you want to proceed?')))) { try { Invoke-MsGRequest -Method Delete -Endpoint $appFedCredEndpoint -Body $body -Headers $Headers -ErrorAction 'Stop' > $null } catch { $errorMessage = Get-MsGErrorMessage $_ $errorException = '{0} : Unable to remove federated credential from the application in Entra ID. Error: {1}' -f $MyInvocation.MyCommand.Name, $errorMessage throw $errorException } } # end region } } |